totor13/armand
ARMANDroid - an ARMAND implementation for Android apps
264
totor13/armand repository overview
ARMAND (Anti-Repackaging through Multi-patternAnti-tampering based on Native Detection) is a novel anti-tampering protection scheme that embeds logic bombs and AT detection nodes directly in the apk file without needing their source code. We developed ARMANDroid, an ARMAND implementation for Android apps. ARMANDroid uses soot to decompile the original apk file and to build a new application, applying anti tampering techniques and build a new application.
It is recommended to use ARMANDroid in combination with an obfuscation tool. In our dockerfile we will use Obfuscapk.
The image files are available on github.
❱ Publication
More details about ARMAND can be found in the paper "ARMAND:Anti-Repackaging through Multi-pattern Anti-tampering based on Native Detection".
We submit it for consideration to PMC journal.
❱ Usage
Docker image
Prerequisites
The only requirement is to have a recent version of Docker installed:
$ docker --version
Docker version 19.03.0, build aeac949
Official Docker Hub image
Pull the armand docker image:
$ # Download the Docker image.
$ docker pull totor13/armand
$ # Give it a shorter name.
$ docker tag totor13/armand armand
Usage
A local directory containing the application to protect has to be
mounted to /workdir in the container (e.g., the current directory "${PWD}") with the
command:
$ docker run --rm -it -u $(id -u):$(id -g) -v "${PWD}":"/workdir" armand [params...]
Simple usage, ARMAND only:
$ docker run --rm -it -u $(id -u):$(id -g) -v "${PWD}":"/workdir" armand -i ${APK_IN} -k "${KEYSTORE_PATH}:${KEYSTORE_PASSWORD}:PKCS12:${KEYSTORE_ALIAS}"
The protected app will be available under ${PWD}/sootOutput.
More information are available in the help message:
$ docker run armand --help
usage: ARMAND
-a,--android-jars <arg> The path to the android jars.
The default is
'$HOME/Android/Sdk/platforms'
-c,--soot-classpath <arg> The path to the wanted
soot.jar file.
-i,--apk-path <arg> The path to the target apk
file.
-ja,--java-at-percentage <arg> The percentage of Java AT
-k,--key-store <arg> Information of the keystore
used to sign the output apk:
<path:type:password:alias>
-na,--native-at-percentage <arg> The percentage of native AT
-ne,--native-encryption-percentage <arg> The percentage of native
encryption
-o,--output-format <arg> The output format (dex,
class). The default is dex
-p,--package-name <arg> The package name where to
insert bombs. "none" to
include all classes (libraries
included). Default value is
taken from Manifest file
Usage with Obfuscapk
Obfuscapk parameters must be added after --obfuscapk. This parameter must be inserted after ARMAND params.
Example:
$ docker run --rm -it -u $(id -u):$(id -g) -v "${PWD}":"/workdir" armand -i ${APK_IN} -k "${KEYSTORE_PATH}:${KEYSTORE_PASSWORD}:PKCS12:${KEYSTORE_ALIAS} --obfuscapk -o RandomManifest -o Rebuild -o NewSignature -o NewAlignment sootOutput/${APK_IN}"
The protected app will be available under ${PWD}/sootOutput/obfuscation_working_dir.
❱ Credits
This software was developed for research purposes at the Computer Security Lab (CSecLab), hosted at DIBRIS, University of Genoa.
❱ Team
- Alessio Merlo - Faculty Member
- Luigi Sciolla - Developer
- Antonio Ruggia - Core Developer
- Luca Verderame - Postdoctoral Researcher
Tag summary
Content type
Image
Digest
Size
2.1 GB
Last updated
almost 6 years ago
docker pull totor13/armand